If Your Company's Google Account Got Hacked Tomorrow Morning, What Would You Lose?

In many businesses, one Google account holds almost everything: email to clients, a Google Drive full of contracts, the operational sheets used every day, the Google Business Profile, the ad account, YouTube, and logins to many other tools through the "Sign in with Google" button. Often that account was created years ago by the owner or the first employee, its password gets shared over chat, and nobody remembers whose phone number is set for recovery.

Imagine that tomorrow morning someone else takes over that account. What would you lose?

Map out the impact

It's worth actually doing this exercise: write down every service that uses the account. The list is usually longer than you expect.

What most often leaves you exposed

In small and mid-sized businesses, the pattern is often similar:

• A personal Gmail account is used as the company account, and shared by several people.
• The password is shared over chat and never changed when someone leaves.
• There's no 2-Step Verification yet.
• There's only one admin. If that person can't be reached, nobody can recover the account.
• The recovery phone number or email belongs to someone who no longer works there.

On accounts stuck with one person, it's the same problem I cover in One Admin Handles Many Client Social Accounts, So How Do You Keep Them Safe? and You Don't Need to Understand Code, But You Need to Know This Before Paying a Developer.

Basic safeguards according to Google

For companies on Google Workspace, Google has security best practices for administrator accounts. The essentials:

1. More than one super admin, each held by a different person. If one account is lost or compromised, another can handle critical tasks while it's recovered.
2. Turn on 2-Step Verification for admin accounts. Google calls security keys the most secure form of 2-Step Verification and the most resistant to phishing.
3. Don't use the super admin account for daily work. Use a regular account, and sign in to the super admin account only for tasks that need it.
4. Set up recovery options, enroll more than one security key, and keep backup codes somewhere safe.

If your business still runs on a personal Gmail account, moving to a company-managed account on your own domain is the single most effective first step.

Recovery features aren't a substitute for backup

Many people assume everything in Google is safe because it's "in the cloud". But there are time limits. In Google Drive, files in Trash are deleted forever after 30 days. On Workspace, an admin can still restore permanently deleted Drive files within 25 days after the user empties the Trash, but the restore covers everything in a date range, not individual files.

So if an attacker deletes data and nobody notices for a month, it can be gone for good. Keep regular copies of important data, such as operational sheets and contract documents, in a separate place with different access.

If it has already happened

Google has steps for securing a hacked account. In short:

1. If you can't sign in, use the account recovery page.
2. Review security activity and remove devices you don't recognize.
3. Check and fix recovery info: phone number, recovery email, and account name.
4. Remove third-party apps with access that you don't recognize.
5. Change the password, including on other services that use the same password.
6. Turn on 2-Step Verification.
7. In Gmail, check delegation, automatic forwarding, filters, and labels, and remove anything you didn't set up. An attacker can set up quiet forwarding so they keep receiving copies of email even after the password changes.

After that, tell your team and key clients. Scam emails from a hacked account tend to be trusted precisely because they come from an address people know. Scams that exploit trust like this are also covered in Asked AI Overview for a Call Center Number, Got Connected to a Scammer.

Wrapping up

A company Google account is a master key to many doors at once. Map out what depends on it, make sure there's more than one admin with 2-Step Verification, and keep copies of important data somewhere else. All of it can be done in a day, and it's far cheaper than recovering after the fact.

If you want to map out the accounts and access in your business, tell me which tools you use first.